A download can finish without giving you the file you expected. Before opening an installer, writing a Linux ISO to a USB drive, or blaming an app for a damaged archive, compare the file’s SHA-256 checksum with the publisher’s value.

You can do the calculation locally with PowerShell on Windows, shasum on macOS, or sha256sum on Linux. You do not need to upload the file to a checksum website. The important part is getting a trustworthy expected checksum for the exact download.

What a matching checksum tells you

A SHA-256 checksum is a 64-character hexadecimal representation of a file’s hash. It depends on the file’s contents, not its name. Renaming an otherwise unchanged download does not change its checksum. Microsoft’s Get-FileHash documentation explains this distinction.

A match provides strong evidence that your file has the same bytes as the file represented by the expected hash. It does not prove that an application is harmless, that its publisher is trustworthy, or that it will work on your computer. If an attacker supplies both a malicious file and its checksum, those two can match perfectly.

1. Find the checksum for the exact file

Start at the publisher’s official website or the project repository linked from it. Look beside the download for a SHA-256 value, a checksums section, or a file named something like SHA256SUMS.

Check all of these before comparing:

  • Version: a checksum for an older release will not verify a newer download.
  • Platform and architecture: Windows, macOS, Linux, ARM64, and x64 builds are different files.
  • Package: an installer, portable ZIP, and source archive need their own checksums.
  • Algorithm: compare SHA-256 with SHA-256, not MD5 or SHA-512.

For GitHub projects, follow the publisher’s installation instructions to the relevant release asset. Code → Download ZIP downloads a source snapshot; it is not interchangeable with a packaged installer. GitHub documents both release packages and source archives. Our GitHub download guide covers the basic download routes.

If the publisher supplies no expected checksum, calculating one yourself cannot establish whether the download is the publisher’s intended file. You can still use it to compare two copies of that file.

2. Calculate the checksum on your computer

Wait for the download to finish. In each command below, replace the sample filename and path with your actual file. The examples only read the file; they do not launch it.

Windows: use PowerShell

Open Windows PowerShell or a PowerShell tab in Windows Terminal, then run:

Get-FileHash -LiteralPath "$HOME\Downloads\tool.zip" -Algorithm SHA256 | Format-List

Read the value beside Hash. -LiteralPath treats the filename literally, including characters such as square brackets. Keep the quotation marks for paths containing spaces. If Downloads is stored somewhere else, substitute the file’s full path. These parameters are documented in Microsoft’s command reference.

Use PowerShell, not a Command Prompt tab: Get-FileHash is a PowerShell command.

macOS: use Terminal and shasum

Open Terminal and run:

shasum -a 256 "$HOME/Downloads/tool.dmg"

The long value at the start of the output is the checksum; the filename follows it. Include -a 256: the shasum documentation lists SHA-1 as its default algorithm. Homebrew’s checksum guidance uses this same SHA-256 command for downloaded files; installing Homebrew is not a step in this procedure.

Linux: use sha256sum

On systems with GNU Coreutils, run:

sha256sum "$HOME/Downloads/tool.AppImage"

The checksum appears before the filename. The sha256sum manual distributed by Debian documents calculation and checksum-file verification. A minimal system may not include the command; consult your distribution’s package documentation rather than downloading an unknown checker.

3. Compare the complete value

Compare all 64 hexadecimal characters with the publisher’s SHA-256 value. Uppercase A–F and lowercase a–f represent the same digits. Ignore the filename and output labels; compare the hash itself, not just its first and last few characters.

  • Match: the file passes this integrity check against that expected value. Keep normal operating-system security checks enabled.
  • Mismatch: do not run or install the file. Follow the checks below before trying again.

A successful hash calculation is not automatically a successful verification. The calculation command can exit successfully even when its printed value differs from the publisher’s value.

Optional: check a publisher’s checksum file

If the publisher provides a plain checksum file in the usual hash-and-filename format, place it beside the download and open a terminal in that folder. Use the actual checksum filename in place of SHA256SUMS.

On Linux:

sha256sum --check SHA256SUMS

On macOS:

shasum -a 256 --check SHA256SUMS

Look for your exact downloaded filename followed by OK. A multi-file list may also report missing files you did not download. That is different from a hash mismatch, but it still means the overall command may fail. Do not treat unrelated OK lines as verification of your file. The shasum reference documents checksum-file input.

If the publisher uses a different format or a signature file, follow its verification instructions instead of assuming every .sha256 or .asc file works with these commands.

Try a small, reproducible practice check

This example verifies a text file you create, not a real software release. In a new, empty practice folder on Linux or macOS, run:

printf '%s' 'abc' > checksum-demo.txt
printf '%s  %s\n' \
  'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad' \
  'checksum-demo.txt' > checksum-demo.sha256

The file contains exactly three bytes: abc, with no trailing newline. On Linux, verify it with:

sha256sum --check checksum-demo.sha256

On macOS, use:

shasum -a 256 --check checksum-demo.sha256

The successful result is:

checksum-demo.txt: OK

Now change one byte without updating the expected checksum:

printf '%s' 'abd' > checksum-demo.txt

Run your verification command again. It reports checksum-demo.txt: FAILED, prints a warning, and returns a nonzero exit status. This is an intentional failure. Restore the practice file with printf '%s' 'abc' > checksum-demo.txt and rerun the check to get OK again.

The practice sequence was checked with both sha256sum and shasum on Linux. That checks the example’s bytes and results; it is not a claim of hands-on Windows or macOS testing.

Troubleshoot a mismatch without bypassing it

What you see What to check next
The hash differs Recheck the version, architecture, package, and algorithm against the publisher’s listing.
The filename ends in .part or .crdownload Let the browser finish; do not hash an incomplete download as if it were final.
The download has been extracted Hash the original archive if the expected value describes the archive, not an extracted file.
No such file or Cannot find path Check the actual location and spelling. Quote the full path, including spaces.
A checksum list says FAILED open or read Check its filenames and your current folder; this is not the same as a computed hash mismatch.
A fresh download still differs Stop and check the publisher’s release notes or support channel. Do not replace the expected hash with your own just to get OK.

A file renamed by the browser, such as tool (1).zip, can still have the correct content hash. A checksum list may nevertheless fail to find it because the list refers to tool.zip. Point a direct calculation at the actual filename, then compare the complete hash.

For files moved between devices, calculate the hash of the original and the received copy using the same algorithm. A match helps confirm the transfer preserved the bytes. Our phone-to-PC file-transfer guide covers transfer options; hashing is a separate integrity check afterward.

When you need more than a checksum

A checksum is only as trustworthy as its expected value. When a project supplies a signed checksum list, follow its documented signature-verification process too, including how to establish trust in the signing key. Ubuntu’s official download-verification tutorial separates checking the signature from checking the ISO’s hash.

Do not disable antivirus, bypass an operating-system warning, or ignore a failed signature because a hash happens to match. Use the checksum to answer one narrow question: does this file match the expected bytes from a source I trust?